D3O-IIoT: deep reinforcement learning-driven dynamic deception orchestration for industrial IoT security

Area of Science:

• Cybersecurity
• Artificial Intelligence
• Industrial Internet of Things (IIoT)

Background:

• Industrial Internet of Things (IIoT) systems face increasing cyber threats exploiting resource limitations and operational vulnerabilities.
• Existing intrusion detection systems lack dynamic adaptation to evolving attack vectors, relying on static or passive defenses.

Purpose of the Study:

• To present D3O-IIoT, a novel reinforcement learning model for dynamic deception orchestration in IIoT cybersecurity.
• To dynamically coordinate deception techniques like honeypots, moving target defense, fake telemetry, and node isolation based on real-time threat monitoring.

Main Methods:

• Formulated the defense problem as a Markov Decision Process.
• Employed a Dueling Deep Q-Network agent to maximize a multi-objective reward balancing attack mitigation, deception engagement, false positive control, and resource cost.
• Validated the model on three IIoT datasets (CIC-IIoT2025, WUSTL-IIoT2021, TON-IoT).

Main Results:

• Achieved a 13.7% attack mitigation rate with a 0.3% false alarm rate, significantly outperforming baseline methods (293-767% improvement).
• Demonstrated strong generalization capabilities with high retention rates across different datasets (97.7% on TON-IoT, 77.8% on WUSTL-IIoT).
• Identified false positive control as the most critical reward component and showed tunability through risk threshold adjustments.

Conclusions:

• D3O-IIoT offers a dynamic, learning-based deception orchestration for IIoT cybersecurity, moving beyond fixed rule-based defenses.
• The model effectively balances multiple practical objectives, including attack mitigation and resource cost, under constrained conditions.
• Real-time deployment is feasible with low latency (2.07ms), favoring isolation for confirmed threats and honeypots for reconnaissance.